September  10,  2004 


Audit  Oversight 

Quality  Control  Review  of  the 
Defense  Finance  and  Accounting 
Service  Office  of  Internal  Review 

(D-2004-6-009) 


Department  of  Defense 
Office  of  the  Inspector  General 


Quality 


Integrity 


Accountability 


Report  Documentation  Page 

Form  Approved 

0MB  No.  0704-0188 

Public  reporting  burden  for  the  collection  of  information  is  estimated  to  average  1  hour  per  response,  including  the  time  for  reviewing  instructions,  searching  existing  data  sources,  gathering  and 
maintaining  the  data  needed,  and  completing  and  reviewing  the  collection  of  information.  Send  comments  regarding  this  burden  estimate  or  any  other  aspect  of  this  collection  of  information, 
including  suggestions  for  reducing  this  burden,  to  Washington  Headquarters  Services,  Directorate  for  Information  Operations  and  Reports,  1215  Jefferson  Davis  Highway,  Suite  1204,  Arlington 

VA  22202-4302.  Respondents  should  be  aware  that  notwithstanding  any  other  provision  of  law,  no  person  shall  be  subject  to  a  penalty  for  failing  to  comply  with  a  collection  of  information  if  it 
does  not  display  a  currently  valid  0MB  control  number. 

1.  REPORT  DATE 

10  SEP  2004 

2.  REPORT  TYPE 

N/A 

3.  DATES  COVERED 

4.  TITLE  AND  SUBTITLE 

5a.  CONTRACT  NUMBER 

Audit  Oversight:  Quality  Control  Review  of  the  Defense  Finance  and 

4 _ _ if  _ 

5b.  GRANT  NUMBER 

/\ccuuiiuiig  aci  vice  Venice  ui  xiiieiiiai  rvcvicw 

5c.  PROGRAM  ELEMENT  NUMBER 

6.  AUTHOR(S) 

5d.  PROJECT  NUMBER 

5e.  TASK  NUMBER 

5f.  WORK  UNIT  NUMBER 

7.  PERFORMING  ORGANIZATION  NAME(S)  AND  ADDRESS(ES) 

Department  of  Defense  Office  of  the  Inspector  General  400  Army  Navy 
Drive  (801)  Arlington,  VA  22202 

8.  PERFORMING  ORGANIZATION 

REPORT  NUMBER 

D-2004-6-009 

9.  SPONSORING/MONITORING  AGENCY  NAME(S)  AND  ADDRESS(ES) 

10.  SPONSOR/MONITOR’S  ACRONYM(S) 

11.  SPONSOR/MONITOR’S  REPORT 
NUMBER(S) 

12.  DISTRIBUTION/AVAILABILITY  STATEMENT 

Approved  for  public  release,  distribution  unlimited 

13.  SUPPLEMENTARY  NOTES 

14.  ABSTRACT 

15.  SUBJECT  TERMS 

16.  SECURITY  CLASSIFICATION  OF: 

17.  LIMITATION  OF 
ABSTRACT 

uu 

18.  NUMBER 

OF  PAGES 

13 

19a.  NAME  OF 
RESPONSIBLE  PERSON 

a.  REPORT 

unclassified 

b.  ABSTRACT 

unclassified 

c.  THIS  PAGE 

unclassified 

Standard  Form  298  (Rev.  8-98} 

Prescribed  by  ANSI  Std  Z39-18 


Additional  Copies 

To  obtain  additional  copies  of  this  report,  visit  the  Web  site  of  the  Inspector 
General  of  the  Department  of  Defense  at  http://www.dodig.osd.mil/audit/reports  or 
contact  the  Office  of  Audit  Policy  and  Oversight  at  (703)  604-8760  or 
fax  (703)  604-9808. 

Suggestions  for  Future  Audits 

To  suggest  ideas  for  or  to  request  future  reviews,  contact  Audit  Policy  and 
Oversight  at  (703)  604-8760  (DSN  664-8760)  or  fax  (703)  604-9808.  Ideas  and 
requests  can  also  be  mailed  to: 

ODIG-APO 

Inspector  General  of  the  Department  of  Defense 
400  Army  Navy  Drive  (Room  1016) 

Arlington,  VA  22202-4704 


DEPARTMENT  OF  DEFENSE 


I 


To  report  fraud,  waste,  mismanagement,  and  abuse  of  authority. 

Send  written  complaints  to:  Defense  Hotline,  The  Pentagon,  Washington,  DC  20301-1900 
Phone:  800.424.9098  e-mail:  hotline@dodiq.osd.mil  www.dodig.osd.mil/hotline 


Acronyms 


DFAS 

GAS 

OIR 

PCIE 


Defense  Finance  and  Accounting  Service 
Government  Auditing  Standards 
Office  of  Internal  Review 
President’s  Council  on  Integrity  and  Efficiency 


INSPECTOR  GENERAL 
DEPARTMENT  OF  DEFENSE 
400  ARMY  NAVY  DRIVE 
ARLINGTON,  VIRGINIA  22202-4704 


September  1 0, 2004 


MEMORANDUM  FOR  DIRECTOR,  DEFENSE  FINANCE  AND  ACCOUNTING 

SERVICE,  OFFICE  OF  INTERNAL  REVIEW 

SUBJECT :  Quality  Control  Review  of  the  Defense  Finance  and  Accounting  Service 
Office  of  Internal  Review  (Report  No.  D-2004-6-009) 


We  are  providing  this  final  report  for  your  review  and  comment.  We  have 
reviewed  the  Defense  Finance  and  Accounting  Service  (DFAS)  Office  of  Internal  Review 
(OIR)  system  of  quality  control  for  the  year  ended  March  31,  2003.  The  Government 
Auditing  Standards  (GAS)  require  that  an  audit  organization  performing  Government 
audits  have  an  appropriate  internal  quality  control  system  and  undergo  an  external  quality 
control  review  every  3  years  by  an  organization  that  is  not  affiliated  with  the  o^anization 
reviewed.  As  the  organization  that  has  audit  policy  and  oversight  responsibilities  for 
audits  in  the  DoD,  we  conducted  this  external  quality  control  review  of  DFAS  OIR. 

An  audit  organization’s  quality  control  policies  and  procedures  should  be 
appropriately  comprehensive  and  suitably  designed  to  provide  reasonable  assurance  of 
meeting  the  objectives  of  quality  control.  We  tested  the  DFAS  OIR  system  of  quality 
control  to  the  extent  considered  appropriate.  The  audits  we  reviewed  were  for  the  year 
ended  March  3 1 , 2003. 

Our  work  to  determine  the  adequacy  of  the  internal  quality  control  system  design 
and  its  compliance  with  policies,  procedures,  and  standards  was  limited  because  DFAS 
OIR  issued  the  “Internal  Review  Audit  Manual,  Policies  and  Procedures”  on 
February  24, 2003,  and  our  review  period  ended  March  31, 2003.  GAS,  1994  revision, 
paragraph  3.33  states  that  an  organization’s  internal  quality  control  system  should  be  in 
place  and  operating  effectively  to  provide  reasonable  assurance  diat  established  policies 
and  procedures  and  applicable  auditing  standards  are  being  followed.  We  were  unable  to 
express  an  opinion  on  the  DFAS  OIR  internal  quality  control  system  for  audit  operations. 
Because  the  policy  and  procedures  for  the  system  had  been  in  place  only  for  a  month,  we 
could  not  deteraiine  whether  the  system  was  operating  effectively.  However,  our  review 
disclosed  areas  where  DFAS  OER  could  improve  compliance  with  GAS. 

Results.  Overall,  we  found  that  DFAS  OIR  needed  to  make  improvements  to  the  quality 
control  pro^am  and  guidance  related  to  the  areas  of  Independence,  Quality  Control, 

Audit  Planning,  Evidence  and  Working  Papers,  and  Audit  Reporting.  The  improvements 
to  the  quality  control  program  should  ensure  that  the  audits  conducted  are  performed 
according  to  GAS.  Additionally,  DFAS  OIR  should  ensure  that  the  areas  identified  for 
improvement  are  reviewed  as  part  of  the  periodic  internal  peer  review. 

Based  on  our  review,  we  have  the  following  comments,  observations,  and 
recommendations  that  if  implemented  should  improve  the  internal  quality  control  system 
of  DFAS  OIR. 


Comments,  Observations,  and  Recommendations 


Independence  Requirements  for  Audit  Managers,  Experts,  and  Non  audit  Services. 

The  DFAS  OIR  Audit  Manual,  Chapter  1210,  addresses  impairments  to  independenee  for 
the  audit  staff  However,  the  poliey  does  not  address  guidanee  for  audit  management, 
experts,  and  non  audit  serviees,  whieh  inereases  the  risk  of  impairments  to  independenee. 
The  GAS  Independenee  Standard,  Amendment  No.  3,  was  issued  January  2002  and 
beeame  effeetive  on  January  1,  2003.  The  Independenee  standard  substantially  ehanged 
the  previous  standard  to  better  serve  the  public  interest  and  to  maintain  a  high  degree  of 
integrity,  objectivity,  and  independence  for  audits  of  government  entities. 

Two  of  the  six  audits  that  we  reviewed  were  completed  after  the  January  2003 
GAS  Independence  Standard,  Amendment  No.  3,  became  effective.  On  the  two  audits, 
the  audit  managers  did  not  document  their  independence  on  the  audit  project.  The  GAS 
Independence  Standard  places  the  responsibility  to  fulfill  the  requirements  of  the 
standard  on  both  the  individual  auditor  and  the  audit  organization.  Although,  DFAS  OIR 
Audit  Manual,  Chapter  1210  requires  the  audit  team  members  to  complete  a  Statement  of 
Independence,  the  site  manager,  who  plans  and  reviews  the  audit  work,  is  not  addressed 
in  the  policy. 

Also,  the  DFAS  OIR  policy  for  independence  does  not  include  guidance  for 
documenting  impairments  to  independence  when  subject  matter  experts  are  used.  We 
reviewed  an  audit  project  in  which  persons  from  a  functional  area  under  audit  were  used 
as  subject  matter  experts.  On  the  audit  project  an  individual  worked  as  both  a  subject 
matter  expert  and  an  interviewee  to  substantiate  information  on  the  audit  subject  area. 
GAS,  1994  revision,  paragraph  3.14  states  “Government  auditors,  including  hired 
consultants  and  internal  experts  and  specialists,  need  to  consider  three  general  classes  of 
impairments  to  independence  —  personal,  external,  and  organizational.  If  one  or  more  of 
these  independence  impairments  affects  an  auditor’s  ability  to  do  the  work  and  report 
findings  impartially,  in  the  situations  where  the  auditor  cannot  decline  to  perform  the 
audit  the  impairment  should  be  reported  in  the  scope  section  of  the  audit  report.”  In  this 
case,  we  found  no  documentation  on  how  the  independence  of  the  internal  experts  was 
addressed.  GAS,  2003  revision,  though  not  a  requirement  at  the  time,  states,  “if  the 
specialist  has  an  impairment  to  independence,  auditors  should  not  use  the  work  of  that 
specialist”  (GAS,  paragraph  3.06).  The  fact  that  DFAS  OIR  did  not  identify  the 
impairment  indicates  the  need  to  strengthen  its  policy  and  ensure  that  audit  team 
members  including  internal  experts  are  independent. 

In  addition,  DFAS  OIR  independence  policy  did  not  address  non  audit  services. 
DFAS  OIR  conducts  consulting  services  for  DFAS  but  has  not  established  safeguards  to 
reduce  the  risk  of  breaching  or  violating  the  overarching  principles.  The  overarching 
principles  as  stated  in  GAS  Independence  Standard,  Amendment  No.  3  and  GAS  2003 
revision  are  “(I)  audit  organizations  should  not  provide  nonaudit  services  that  involve 
performing  management  functions  or  making  management  decisions  and  (2)  audit 
organizations  should  not  audit  their  own  work  or  provide  nonaudit  services  in  situations 
where  the  nonaudit  services  are  significant/material  to  the  subject  matter  of  the  audits” 
(GAS,  2003  revision,  paragraph  3.13).  GAS  Independence  Standard,  Amendment  No.  3, 
went  into  effect  January  I,  2003.  At  the  time  of  our  review,  DFAS  OIR  drafted  guidance 
on  non  audit  services  dated  May  2003. 
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However,  the  DFAS  OIR  Audit  Manual  issued  February  2003  should  have  ineluded 
poliey  establishing  safeguards  to  reduee  the  opportunity  of  an  individual  auditor 
impairing  their  independenee  or  the  organization’s  independenee. 

Recommendation,  We  reeommend  that  the  Direetor,  Defense  Finanee  and 
Aeeounting  Serviee,  Offiee  of  Internal  Review: 

•  Revise  DFAS  OIR  poliey  on  Independenee  to  inelude  guidanee  for  audit 
managers,  experts,  and  non  audit  serviees. 

•  Establish  a  poliey  on  non  audit  serviees  eonsistent  with  requirements 
established  in  GAS. 

Management  Comments.  The  Direetor,  Defense  Finanee  and  Aeeounting 
Serviee,  Offiee  of  Internal  Review  eoneurred  with  the  reeommendation. 

Quality  Control  Guidance,  The  DFAS  OIR  Audit  Manual,  Chapter  1100  requires  all 
final  reports  to  be  independently  refereneed  and  all  site  offiees  to  undergo  a  periodie 
internal  peer  review  eondueted  every  2  years  and  allows  the  Direetor  or  Deputy  Direetor 
to  request  a  Quality  Assuranee  Review  on  select  assignments.  The  quality  controls  used 
before  February  24,  2003,  consisted  of  checklists  and  independent  reference  reviews. 
However,  DFAS  OIR  did  not  apply  the  quality  controls  consistently.  DFAS  OIR  auditors 
did  not  perform  the  required  quality  controls  on  four  of  the  six  audits  we  reviewed.  On 
one  audit,  we  found  that  the  audit  supervisor  identified  that  quality  controls  were  not 
performed  for  the  audit  project  and  did  not  provide  an  explanation  or  state  what 
mitigating  actions  were  taken  to  ensure  that  a  factually  accurate  audit  report  was  issued. 
GAS,  1994  revision,  paragraph  3.29  states  “situations  may  occur  in  which  government 
auditors  are  not  able  to  follow  an  applicable  standard  and  are  not  able  to  withdraw  from 
the  audit.  In  those  situations,  the  auditors  should  disclose  in  the  scope  section  of  their 
report,  the  fact  that  an  applicable  standard  was  not  followed,  the  reasons  therefore,  and 
the  known  effect  that  not  following  the  standard  had  on  the  results  of  the  audit.” 

GAS,  2003  revision,  paragraph  3.34  further  requires  that  if  auditors  state  they  are 
performing  their  work  in  accordance  with  GAS,  they  should  justify  any  departures  from 
GAS.  When  an  exception  is  identified  to  the  quality  control  standard,  an  explanation 
needs  to  accompany  that  deviation  from  the  standard. 

Recommendation.  We  recommend  that  the  Director,  Defense  Finance  and 
Accounting  Service,  Office  of  Internal  Review  ensure  DFAS  OIR  include  as  part 
of  the  periodic  internal  peer  review  the  areas  identified  for  improvement. 

Management  Comments.  The  Director,  Defense  Finance  and  Accounting 
Service,  Office  of  Internal  Review  concurred  with  the  recommendation. 

Audit  Planning  Requirements,  The  DFAS  OIR  Audit  Manual,  Chapter  1210 
establishes  guidance  for  planning  the  audit.  We  found  inconsistent  application  of  the 
GAS  audit  planning  requirements  on  the  audits  we  reviewed. 
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Specifically,  in  the  areas  of  considering  other’s  work,  designing  for  compliance  with 
legal  and  regulatory  requirements,  and  assessing  management  controls,  DFAS  OIR  did 
not  consistently  apply  the  requirements  to  their  audit  projects. 

Considering  Other’s  Work,  GAS,  1994  revision,  requires  that  when  using 
other’s  work,  the  audit  staff  should  have  some  basis  for  reliance  on  that  work.  On  one 
audit  we  reviewed,  subject  matter  experts  were  used  in  the  audit.  The  audit  staff 
documented  verbal  assertions  made  by  the  subject  matter  experts  on  the  assessment  of 
illegal  acts  and  management  controls.  GAS  6.15  and  6.16  requires  that  when  relying  on 
the  work  of  non  auditors,  such  as  subject  matter  experts,  audit  staff  should  perform 
procedures  that  provide  sufficient  basis  for  that  reliance.  We  did  not  find  audit  working 
papers  that  documented  the  basis  for  the  auditors’  reliance  on  the  subject  matter  experts’ 
assertions. 

Designing  for  Compliance  with  Legal  and  Regulatory  Requirements,  DFAS 
OIR  did  not  consistently  consider  legal  and  regulatory  requirements.  On  three  audit 
projects  we  reviewed,  the  audit  staff  did  not  design  the  audit  to  provide  reasonable 
assurance  about  compliance  with  laws  and  regulations  that  are  significant  to  audit 
objectives  as  required  in  GAS,  1994  revision,  paragraph  6.28.  In  addition,  on  one  of  the 
three  audit  projects,  the  audit  report  identified  different  potential  risk  areas  than  the  risk 
areas  identified  in  the  audit  working  papers.  Neither  the  audit  report  nor  the  working 
papers  for  that  audit  project  provided  support  for  the  risk  areas  identified. 

Assessing  Management  Controls,  On  three  audit  projects,  we  found  that  the 
audit  staff  did  not  assess  management  controls  that  were  significant  to  the  audit 
objectives.  The  objective  of  each  of  the  three  audit  projects  was  to  review  some  aspect  of 
a  financial  system  or  the  data  processed  through  a  financial  system.  GAS,  1994  revision, 
paragraph  6.44  states  “internal  auditing  is  an  important  part  of  management  control.” 

The  DFAS  OIR  mission  makes  it  necessary  for  the  audits  to  assess  management  controls 
significant  to  audit  objectives.  DFAS  OIR  assessment  of  management  controls  provides 
DFAS  managers  reasonable  assurance  that  controls  are  functioning  properly.  This  will 
prevent  duplication  of  effort  for  auditors  who  may  rely  on  their  work  as  stated  in  GAS, 
1994  revision,  paragraph  6.44. 

Recommendation,  We  recommend  that  the  Director,  Defense  Finance  and 

Accounting  Service,  Office  of  Internal  Review  revise  the  DFAS  OIR  Audit 

Manual,  Chapter  1210  to  include  guidance  for  considering  other’s  work. 

Management  Comments,  The  Director,  Defense  Finance  and  Accounting 

Service,  Office  of  Internal  Review  concurred  with  the  recommendation. 

Evidence  and  Working  Papers  Guidance  and  Quality,  DFAS  OIR  Audit  Manual, 
Chapter  1270  states  that  exceptions  to  placing  purpose  and  source  on  some  working 
papers  is  left  to  the  discretion  of  the  audit  staff.  GAS,  2003  revision,  paragraph  7.68 
states,  “audit  documentation  should  be  appropriately  detailed  to  provide  a  clear 
understanding  of  its  purpose  and  source  and  the  conclusions  the  auditors  reached.”  The 
DFAS  OIR  manual  should  include  examples  or  guidance  for  exceptions  to  working  paper 
elements. 

Also,  we  identified  situations  that  affected  the  quality  of  evidence  and  working 
papers.  We  found  inconsistent  cross-referencing  of  supporting  documentation  to  the 
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audit  findings  and  the  audit  report.  Two  of  the  six  audits  we  reviewed  were  eompleted 
after  the  issuanee  of  the  DFAS  IR  Audit  Manual.  On  one  of  the  two  audit  projeets,  a 
statement  loeated  in  the  audit  plan  supported  a  eross-referenee  for  a  dollar  figure  in  the 
audit  report,  but  the  audit  plan  was  not  eross-refereneed  to  supporting  doeumentation. 

On  that  same  audit  project,  a  percent  number  used  in  the  audit  report  was  cross- 
referenced  to  a  spreadsheet  in  which  only  part  of  the  figure  could  be  verified.  In 
addition,  we  reviewed  two  audit  projects  with  incomplete  audit  working  papers  even 
though  DFAS  OIR  issued  the  audit  reports  several  months  before  our  review.  GAS,  2003 
revision,  paragraph  7.68c  requires  that  the  audit  documentation  for  performance  audits 
contain  the  work  performed  to  support  significant  judgments  and  conclusions,  including 
descriptions  of  transactions  and  records  examined.  In  addition,  GAS,  paragraph  7.68d 
requires  that  audit  documentation  include  evidence  of  supervisory  reviews,  before  the 
audit  report  is  issued,  of  the  work  performed  that  supports  findings,  conclusions,  and 
recommendations  contained  in  the  audit  report.  Therefore,  we  were  unable  to  completely 
assess  the  audit  quality  or  determine  whether  the  work  performed  supported  the 
significant  conclusions  and  judgments  as  prescribed  in  GAS,  1994  revision,  paragraph 
6.64. 

Audit  Report  Statements.  On  three  of  the  six  audit  projects  we  reviewed,  the  audit 
report  statements  did  not  accurately  describe  the  work  performed.  On  one  audit  report,  it 
stated  that  management  controls  were  tested  but  we  found  no  working  papers  to  support 
that  management  controls  had  been  assessed.  On  another  audit  report,  the  report  stated 
that  the  auditors  performed  compliance  with  laws  and  regulations;  however,  our  review 
found  no  working  papers  to  support  that  steps  had  been  designed  to  detect 
noncompliance.  On  a  third  audit  report,  the  auditors  reported  that  they  did  not  perform 
the  customary  auditing  procedures  necessary  to  constitute  an  examination  made 
according  to  GAS;  however,  the  auditors  did  not  provide  reasons  why  the  standards  were 
not  followed.  GAS,  1994  revision,  paragraph  7.55  states  “the  report  should  include  only 
information,  findings  and  conclusions  that  are  supported  by  competent  and  relevant 
evidence  in  the  auditors’  working  papers.” 

Recommendation,  We  recommend  that  the  Director,  Defense  Finance  and 

Accounting  Service,  Office  of  Internal  Review  revise  the  DFAS  OIR  Audit 

Manual,  Chapter  1270  on  working  paper  elements  to  agree  with  GAS. 

Management  Comments,  The  Director,  Defense  Finance  and  Accounting 

Service,  Office  of  Internal  Review  concurred  with  the  recommendation. 
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The  Director,  Defense  Finance  and  Accounting  Service,  Office  of  Internal  Review 
provided  conunents  to  a  draft  of  this  report,  which  are  attached.  See  Appendix  A  for  the 
scope  and  methodology  of  the  review  and  Appendix  B  for  the  rq>ort  distribution.  Please 
call  Ms.  Wanda  Scotland  at  (703)  602-1033  or  Nfi'.  George  Hunter  at  (703)  604-8756  if 
you  have  any  questions. 


P^cia  A.  Brannin 
Assis^t  fiispector  General 
Audit  Policy  and  Oversight 
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Appendix  A.  Scope  and  Methodology 


The  mission  of  DFAS  is  to  provide  responsive,  professional  finanee  and 
aoeounting  serviees  for  the  people  who  defend  Ameriea.  The  DFAS  OIR  mission  is  to 
provide  responsive,  professional,  and  objective  information  and  advice  to  enhance  the 
DFAS  stewardship  over  Department  of  Defense  resources.  DFAS  OIR  examines 
programs,  systems,  and  processes  and  provides  information,  analyses,  assessments, 
recommendations,  and  other  assistance  applicable  to  DFAS  management  duties  and 
objectives.  DFAS  OIR  is  a  partner  with  management  in  its  efforts  to  continuously 
improve  the  efficiency  and  effectiveness  of  DFAS  programs  and  processes.  “DFAS  OIR 
has  four  audit  services  managers  that  support  DFAS’  three  business  lines  (Accounting, 
Commercial  Pay,  and  Military/Civilian  Pay)  and  DFAS’  Corporate  Resources  and 
Elements.  DFAS  OIR  audit  services  managers  ensure  specific  functional  and  policy 
concerns  of  the  DFAS  business  lines  are  addressed.”  The  DFAS  Internal  Review  Audit 
Manual  Policies  and  Procedures  dated  February  24,  2003,  provides  guidance  on  the 
performance  of  audits  within  DFAS  OIR.  The  audit  manual  states,  “It  is  the  policy  of 
Internal  Review  to  adhere  to  the  GAS  issued  by  the  Comptroller  General  of  the  United 
States  in  the  conduct  of  its  audits  and  audit-related  operations.”  The  GAS  published  by 
the  U.S.  Comptroller  General  is  the  criteria  guiding  auditors  in  their  work  to  ensure 
quality  and  reliable  audit  results.  The  GAS  require  that  the  internal  quality  control 
system  established  by  the  audit  organization  should  provide  reasonable  assurance  that  it 
has  adopted,  and  is  following,  applicable  auditing  standards  and  has  established,  and  is 
following,  adequate  audit  policies  and  procedures. 

The  Assistant  Inspector  General  for  Audit  Policy  and  Oversight,  Office  of  the 
Deputy  Inspector  General  for  Inspections  and  Policy  of  the  Department  of  Defense 
conducted  the  review.  The  review  team  could  not  evaluate  all  aspects  of  the  DFAS  OIR 
system  of  quality  control  because  of  the  brief  time  between  the  issue  date  of  the  audit 
manual  and  the  end  of  the  review  period.  However,  we  did  perform  a  review  on  6  of  47 
audit  reports  issued  between  April  1,  2002,  and  March  31,  2003,  for  compliance  with 
GAS  to  the  extent  practicable  given  the  issue  date  of  the  audit  manual.  The  review  team 
evaluated  working  papers  for  the  selected  audits,  conducted  interviews  of  staff  members, 
and  performed  tests  of  documentation. 

From  April  2003  to  April  2004  (from  September  2003  to  January  2004,  the 
review  was  suspended),  the  external  review  team  reviewed  the  quality  control  program  of 
the  audit  function  for  the  DFAS  OIR  from  April  1,  2002,  through  March  31,  2003.  The 
team  used  the  guidelines  and  checklists  established  by  the  President’s  Council  on 
Integrity  and  Efficiency  (PCIE)  as  amended  February  2002  to  determine  whether  the 
DFAS  OIR  quality  control  program  conformed  with  GAS.  The  review  team  adjusted  the 
PCIE  guidelines  and  checklists  as  appropriate  to  reflect  the  DFAS  OIR.  The  review  team 
considered  several  factors  in  applying  the  PCIE  guidelines,  such  as  the  size  of  the  DFAS 
OIR,  the  degree  of  operating  autonomy  allowed,  and  the  nature  of  work.  In  conducting 
the  review,  the  review  team  evaluated  6  of  47  audit  reports  issued  in  the  period  reviewed 
and  associated  working  papers  for  the  reports.  We  also  reviewed  training  and 
educational  activity  documentation  for  the  period  of  January  1,  2001,  through  December 
31,  2002,  for  full-time  auditors  in  the  DFAS  Internal  Review  Office. 
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We  considered  the  1994  revision  of  GAS,  as  amended,  because  the  audits  selected 
for  review  were  completed  before  the  June  2003  revision  of  the  GAS  was  issued. 
However,  we  included  the  GAS  Independence  Standard,  Amendment  No.  3,  issued 
January  2002,  which  became  effective  January  1,  2003.  Also,  we  provided,  where 
appropriate,  suggestions  for  modifying  operating  procedures  based  on  the  2003  revision 
of  the  GAS,  which  became  effective  January  1,  2004. 

Limitations  of  Review.  The  objective  of  our  review  was  to  determine  whether  the 
DFAS  OIR  was  performing  audits  according  to  GAS.  We  did  not  review  the  Internal 
Review  functions  that  are  not  related  to  audit  such  as  investigations,  advisory  and 
assistance  services,  and  the  liaison  function.  We  conducted  our  review  in  conformance 
with  standards  and  guidelines  established  by  the  PCIE  for  reviews  of  audit  operations. 
Our  review  would  not  necessarily  disclose  all  weaknesses  but  is  to  provide  reasonable 
assurance  that  the  DFAS  OIR  system  of  internal  quality  control  was  adequate  and  that 
quality  control  policies  and  procedures  are  being  followed.  Departures  from  the  quality 
control  system  may  occur  because  of  a  misunderstanding  of  instructions,  mistakes  of 
judgment,  carelessness,  or  other  human  factors.  Additionally,  the  departures  from  the 
quality  control  system  may  not  be  detected.  Projecting  any  evaluation  of  a  quality 
control  system  into  the  future  is  subject  to  the  risk  that  one  or  more  procedures  may 
become  inadequate  because  conditions  may  change  or  the  degree  of  compliance  with 
procedures  may  deteriorate. 
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Appendix  B.  Report  Distribution 

Other  Defense  Organizations 

Director,  Defense  Finance  and  Accounting  Service 

Director,  Office  of  Internal  Review,  Defense  Finance  and  Accounting  Service 


Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
House  Committee  on  Armed  Services 
House  Committee  on  Government  Reform 

House  Subcommittee  on  Government  Efficiency  and  Financial  Management,  Committee 
on  Government  Reform 

House  Subcommittee  on  National  Security,  Emerging  Threats,  and  International 
Relations,  Committee  on  Government  Reform 
House  Subcommittee  on  Technology,  Information  Policy,  Intergovernmental  Relations, 
and  the  Census,  Committee  on  Government  Reform 
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Defense  Finance  and  Accounting  Service,  Office 
of  Internal  Review  Comments 


DEFENSE  FINANCE  AND  ACCOUNTING  SERVICE 
ARUNGTON 

1851  SOUTH  BELL  STREET 
ARLINGTON.  VA  22240-5291 


SEP  8  2004 


DDI 


MEMORANDUM  FOR  ASSISTANT  INSPECTOR  GENERAL  FOR  AUDH'  POLICY 
AND  OVERSIGHT,  OFFICE  OF  THE  INSPECTOR 
GENERAL,  DEPARTMENT  OF  DEFENSE 


SUBJECT :  Comments  to  the  Office  of  Inspector  General,  Department  of  Defense 

Draft  Quality  Control  Review  of  the  Defense  Finance  and  Accounting 
Service  Office  of  Internal  Review  (Project  No.  D2003-OC-0105) 

Thank  for  the  opportunity  to  review  and  comment  on  the  results  from  the  subject 
report.  It  provides  useful  and  timely  recommendations  for  ensuring  the  quality  of  our 
audit  work  as  our  organization  develops.  The  Defense  Finance  and  Accounting  Service 
(DFAS)  formally  organized  the  Office  of  Internal  Review  during  spring  2000  to  provide 
independent  internal  auditing  services  to  ensure  accountability  and  integrity  in  DFAS 
operations.  Through  diligent  recruiting  and  training  efforts,  we  have  transitioned  into  a 
full  scope  audit  organization.  During  that  transition,  we  issued  the  DFAS  Internal 
Review  Audit  Manual  in  February  2003  to  document  our  policies  and  procedures  for 
implementing  Government  Auditing  Standards  (GAS).  It  is  important  to  note  that  four  of 
the  six  audits  for  the  subject  review  were  completed  prior  to  the  issuance  of  the  Internal 
Review  Audit  Manual.  The  remaining  two  audits  were  issued  shortly  after  the  issuance  of 
the  Audit  Manual.  Although  we  were  striving  to  address  the  critical  guidance  within 
GAS  and  our  Audit  Manual,  we  recognize  there  were  areas  needing  further  attention. 
Your  report  will  serve  to  help  us  assure  we  are  providing  a  superior  quality  of  work. 

The  following  are  our  comments  to  each  of  the  five  recommendations  in  the  subject 
report: 

1 .  Revise  DFAS  Office  of  Internal  Review  (OIR)  policy  on  Independence  to  include 
guidance  for  audit  managers,  experts,  and  non-audit  services. 

Internal  Review  response:  Concur.  We  will  revise  our  policy  on  independence  to 
specifically  cover  audit  managers,  experts,  and  non-audit  services. 

2.  Establish  a  policy  on  non-audit  services  consistent  with  the  requirements  established 
in  Government  Auditing  Standards  (GAS). 

Internal  Review  response:  Concur.  We  have  a  non-audit  services  DFAS  Internal 
Review  Audit  Manual  chapter  in  draft.  We  will  ensure  that  it  is  consistent  with  GAS 
prior  to  its  issuance. 
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3.  Ensure  DFAS  OIR  include  as  part  of  the  periodic  internal  peer  review  the  (quality 
control)  areas  identified  for  improvement. 

Internal  Review  response:  Concur.  Wc  began  our  internal  peer  review  process 
during  April  2004.  We  will  ensure  that  the  process  includes  coverage  of  the  areas 
identified  in  your  report. 

4.  Revise  the  DFAS  OIR  Audit  Manual,  Chapter  1210,  to  include  guidance  for 
considering  other’s  work. 

Internal  Review  response:  Concur.  Wc  will  revise  Audit  Manual  Chapter  1210  to 
include  guidance  for  considering  other’s  work. 

5.  Revise  the  DFAS  OIR  Audit  Manual  Chapter  1 270  on  working  paper  elements  to 
agree  with  GAS. 

Internal  Review  response:  Generally  coneur.  We  will  revise  our  Audit  Manual  to 
clarify  requirements  for  working  paper  elements  and  provide  examples  w'here 
appropriate.  However,  Audit  Manual,  Chapter  1270,  currently  addresses  the  issues 
identified  in  your  review  and  is  consistent  with  GAS.  The  issues  were  the  result  of 
audit  teams  not  following  the  requirements  of  the  Audit  Manual  noting  that  the  six 
audits  under  review  were  either  complete  or  substantially  complete  at  the  time  of  the 
issuance  of  the  Audit  Manual.  We  believe  that  the  identified  issues  will  be  addressed 
moving  forward  by  placing  stronger  emphasis  on  cross-indexing,  independent 
referencing,  audit  documentation,  and  reporting  guidance. 

The  report  indicates  that  Audit  Manual  Chapter  1270  states  that  exceptions  to  placing 
purpose  and  source  on  some  working  papers  is  left  to  the  discretion  of  the  audit  staff.  The 
Audit  Manual  Chapter  1270  specifically  states,  “Generally,  working  papers  document  the 
purpose,  source,  scope,  and  conclusion.  Purpose  and  source  may  be  sufficient  on  some 
working  papers  while  on  others,  such  as  summaries  or  analytical  working  papers,  all 
elements  may  be  appropriate.”  Our  general  requirement  is  to  include  Purpose,  Source, 
Scope,  and  Conclusion  on  working  papers.  Working  papers  should  include  at  a  minimum 
the  Purpose  and  Source  elements. 

Thank  you  again  for  providing  the  subject  report  for  comment  and  review.  If  you 
have  any  questions,  please  feel  free  to  contact  me  on  (703)  607-5129  or  Mr.  Jack  Rouch, 
Deputy  Director  of  htemal  Review  on  (703)  607-3963. 


/  George  A.  Sullivan 
Director  of  Internal  Review 
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